CVE-2020-28865: Insufficiently Protected Credentials in PowerJob
Summary
CVE-2020-28865: Insufficiently Protected Credentials in PowerJob. Affects com.github.kfcfans:powerjob versions < 3.3.3. Fixed in 3.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PowerJob is an open-source library that provides distributed task scheduling and job orchestration capabilities. It is commonly used in Maven projects. The vulnerability identified as CVE-2020-28865 allows attackers to change arbitrary user passwords by exploiting the 'id' parameter in the '/appinfo/save' endpoint. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
Vulnerability Detail
The vulnerability arises due to insufficient protection of credentials in PowerJob. By manipulating the 'id' parameter in the '/appinfo/save' endpoint, attackers can modify user passwords without proper authorization. This can lead to unauthorized access, privilege escalation, and potential compromise of sensitive information.
How To Fix
Latest published version: 3.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional access controls and input validation to mitigate the risk of unauthorized password changes. This can include enforcing strong authentication mechanisms, implementing rate limiting, and validating user input before processing the 'id' parameter.
Conclusion
The vulnerability CVE-2020-28865 in PowerJob allows attackers to change arbitrary user passwords, potentially leading to unauthorized access and compromise of sensitive information. It is crucial to upgrade to PowerJob version 3.3.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.github.kfcfans:powerjob →
FAQ
PowerJob is an open-source library that provides distributed task scheduling and job orchestration capabilities. It is commonly used in Maven projects.
The vulnerability allows attackers to change arbitrary user passwords, potentially leading to unauthorized access, privilege escalation, and compromise of sensitive information.
To fix this vulnerability, it is recommended to upgrade PowerJob to version 3.3.3 or later. This version includes the necessary security patches to address the issue.
As a temporary workaround, developers can implement additional access controls and input validation to mitigate the risk of unauthorized password changes.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
